update to latest 2.26.0 kubespray version and add dns zones settings to coredns

kubespray/project/roles/etcd/defaults/main.yml

@@ -124,4 +124,7 @@ unsafe_show_logs: false
 etcd_experimental_enable_distributed_tracing: false
 etcd_experimental_distributed_tracing_sample_rate: 100
 etcd_experimental_distributed_tracing_address: "localhost:4317"
-etcd_experimental_distributed_tracing_service_name: etcd
+etcd_experimental_distributed_tracing_service_name: etcd
+
+# The interval for etcd watch progress notify events
+etcd_experimental_watch_progress_notify_interval: 5s

kubespray/project/roles/etcd/handlers/backup.yml

@@ -16,16 +16,16 @@
     state: directory
     owner: root
     group: root
-    mode: 0600
+    mode: "0600"
   listen: Restart etcd
   when: etcd_cluster_is_healthy.rc == 0
 
 - name: Stat etcd v2 data directory
   stat:
     path: "{{ etcd_data_dir }}/member"
-    get_attributes: no
-    get_checksum: no
-    get_mime: no
+    get_attributes: false
+    get_checksum: false
+    get_mime: false
   register: etcd_data_dir_member
   listen: Restart etcd
   when: etcd_cluster_is_healthy.rc == 0

kubespray/project/roles/etcd/handlers/main.yml

@@ -3,7 +3,7 @@
   import_tasks: backup.yml
 
 - name: Etcd | reload systemd
-  systemd:
+  systemd_service:
     daemon_reload: true
   listen:
     - Restart etcd
@@ -26,7 +26,7 @@
 - name: Wait for etcd up
   uri:
     url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2379/health"
-    validate_certs: no
+    validate_certs: false
     client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
     client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
   register: result
@@ -41,7 +41,7 @@
 - name: Wait for etcd-events up
   uri:
     url: "https://{% if is_etcd_master %}{{ etcd_address }}{% else %}127.0.0.1{% endif %}:2383/health"
-    validate_certs: no
+    validate_certs: false
     client_cert: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem"
     client_key: "{{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem"
   register: result

kubespray/project/roles/etcd/tasks/check_certs.yml

@@ -17,9 +17,9 @@
 - name: "Check certs | Register ca and etcd admin/member certs on etcd hosts"
   stat:
     path: "{{ etcd_cert_dir }}/{{ item }}"
-    get_attributes: no
-    get_checksum: yes
-    get_mime: no
+    get_attributes: false
+    get_checksum: true
+    get_mime: false
   register: etcd_member_certs
   when: inventory_hostname in groups['etcd']
   with_items:

kubespray/project/roles/etcd/tasks/configure.yml

@@ -6,8 +6,8 @@
   register: etcd_cluster_is_healthy
   failed_when: false
   changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
   when:
     - is_etcd_master
     - etcd_cluster_setup
@@ -27,8 +27,8 @@
   register: etcd_events_cluster_is_healthy
   failed_when: false
   changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
   when:
     - is_etcd_master
     - etcd_events_cluster_setup
@@ -49,8 +49,8 @@
   template:
     src: "etcd-{{ etcd_deployment_type }}.service.j2"
     dest: /etc/systemd/system/etcd.service
-    backup: yes
-    mode: 0644
+    backup: true
+    mode: "0644"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:etcd-{{ etcd_deployment_type }}.service'"
@@ -60,15 +60,15 @@
   template:
     src: "etcd-events-{{ etcd_deployment_type }}.service.j2"
     dest: /etc/systemd/system/etcd-events.service
-    backup: yes
-    mode: 0644
+    backup: true
+    mode: "0644"
     validate: "sh -c '[ -f /usr/bin/systemd/system/factory-reset.target ] || exit 0 && systemd-analyze verify %s:etcd-events-{{ etcd_deployment_type }}.service'"
     # FIXME: check that systemd version >= 250 (factory-reset.target was introduced in that release)
     # Remove once we drop support for systemd < 250
   when: is_etcd_master and etcd_events_cluster_setup
 
 - name: Configure | reload systemd
-  systemd:
+  systemd_service:
     daemon_reload: true
   when: is_etcd_master
 
@@ -77,7 +77,7 @@
   service:
     name: etcd
     state: started
-    enabled: yes
+    enabled: true
   ignore_errors: "{{ etcd_cluster_is_healthy.rc == 0 }}"  # noqa ignore-errors
   when: is_etcd_master and etcd_cluster_setup
 
@@ -86,7 +86,7 @@
   service:
     name: etcd-events
     state: started
-    enabled: yes
+    enabled: true
   ignore_errors: "{{ etcd_events_cluster_is_healthy.rc != 0 }}"  # noqa ignore-errors
   when: is_etcd_master and etcd_events_cluster_setup
 
@@ -99,8 +99,8 @@
   retries: "{{ etcd_retries }}"
   delay: "{{ retry_stagger | random + 3 }}"
   changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
   when:
     - is_etcd_master
     - etcd_cluster_setup
@@ -122,8 +122,8 @@
   retries: "{{ etcd_retries }}"
   delay: "{{ retry_stagger | random + 3 }}"
   changed_when: false
-  check_mode: no
-  run_once: yes
+  check_mode: false
+  run_once: true
   when:
     - is_etcd_master
     - etcd_events_cluster_setup
@@ -141,7 +141,7 @@
   register: etcd_member_in_cluster
   ignore_errors: true  # noqa ignore-errors
   changed_when: false
-  check_mode: no
+  check_mode: false
   when: is_etcd_master and etcd_cluster_setup
   tags:
     - facts
@@ -157,7 +157,7 @@
   register: etcd_events_member_in_cluster
   ignore_errors: true  # noqa ignore-errors
   changed_when: false
-  check_mode: no
+  check_mode: false
   when: is_etcd_master and etcd_events_cluster_setup
   tags:
     - facts

kubespray/project/roles/etcd/tasks/gen_certs_script.yml

@@ -6,23 +6,23 @@
     state: directory
     owner: "{{ etcd_owner }}"
     mode: "{{ etcd_cert_dir_mode }}"
-    recurse: yes
+    recurse: true
 
 - name: "Gen_certs | create etcd script dir (on {{ groups['etcd'][0] }})"
   file:
     path: "{{ etcd_script_dir }}"
     state: directory
     owner: root
-    mode: 0700
-  run_once: yes
+    mode: "0700"
+  run_once: true
   when: inventory_hostname == groups['etcd'][0]
 
 - name: Gen_certs | write openssl config
   template:
     src: "openssl.conf.j2"
     dest: "{{ etcd_config_dir }}/openssl.conf"
-    mode: 0640
-  run_once: yes
+    mode: "0640"
+  run_once: true
   delegate_to: "{{ groups['etcd'][0] }}"
   when:
     - gen_certs | default(false)
@@ -32,8 +32,8 @@
   template:
     src: "make-ssl-etcd.sh.j2"
     dest: "{{ etcd_script_dir }}/make-ssl-etcd.sh"
-    mode: 0700
-  run_once: yes
+    mode: "0700"
+  run_once: true
   when:
     - gen_certs | default(false)
     - inventory_hostname == groups['etcd'][0]
@@ -43,7 +43,7 @@
   environment:
     MASTERS: "{{ groups['gen_master_certs_True'] | ansible.builtin.intersect(groups['etcd']) | join(' ') }}"
     HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['kube_control_plane']) | join(' ') }}"
-  run_once: yes
+  run_once: true
   delegate_to: "{{ groups['etcd'][0] }}"
   when: gen_certs | default(false)
   notify: Set etcd_secret_changed
@@ -52,7 +52,7 @@
   command: "bash -x {{ etcd_script_dir }}/make-ssl-etcd.sh -f {{ etcd_config_dir }}/openssl.conf -d {{ etcd_cert_dir }}"
   environment:
     HOSTS: "{{ groups['gen_node_certs_True'] | ansible.builtin.intersect(groups['k8s_cluster']) | join(' ') }}"
-  run_once: yes
+  run_once: true
   delegate_to: "{{ groups['etcd'][0] }}"
   when:
     - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool
@@ -90,7 +90,7 @@
     content: "{{ item.content | b64decode }}"
     group: "{{ etcd_cert_group }}"
     owner: "{{ etcd_owner }}"
-    mode: 0640
+    mode: "0640"
   with_items: "{{ etcd_master_certs.results }}"
   when:
     - inventory_hostname in groups['etcd']
@@ -122,7 +122,7 @@
     content: "{{ item.content | b64decode }}"
     group: "{{ etcd_cert_group }}"
     owner: "{{ etcd_owner }}"
-    mode: 0640
+    mode: "0640"
   with_items: "{{ etcd_master_node_certs.results }}"
   when:
     - inventory_hostname in groups['etcd']
@@ -153,4 +153,4 @@
     state: directory
     owner: "{{ etcd_owner }}"
     mode: "{{ etcd_cert_dir_mode }}"
-    recurse: yes
+    recurse: true

kubespray/project/roles/etcd/tasks/gen_nodes_certs_script.yml

@@ -21,7 +21,7 @@
     executable: /bin/bash
   no_log: "{{ not (unsafe_show_logs | bool) }}"
   register: etcd_node_certs
-  check_mode: no
+  check_mode: false
   delegate_to: "{{ groups['etcd'][0] }}"
   changed_when: false
 

kubespray/project/roles/etcd/tasks/install_docker.yml

@@ -28,8 +28,8 @@
     src: etcd.j2
     dest: "{{ bin_dir }}/etcd"
     owner: 'root'
-    mode: 0750
-    backup: yes
+    mode: "0750"
+    backup: true
   when: etcd_cluster_setup
 
 - name: Install etcd-events launch script
@@ -37,6 +37,6 @@
     src: etcd-events.j2
     dest: "{{ bin_dir }}/etcd-events"
     owner: 'root'
-    mode: 0750
-    backup: yes
+    mode: "0750"
+    backup: true
   when: etcd_events_cluster_setup

kubespray/project/roles/etcd/tasks/install_host.yml

@@ -24,8 +24,8 @@
   copy:
     src: "{{ local_release_dir }}/etcd-{{ etcd_version }}-linux-{{ host_architecture }}/{{ item }}"
     dest: "{{ bin_dir }}/{{ item }}"
-    mode: 0755
-    remote_src: yes
+    mode: "0755"
+    remote_src: true
   with_items:
     - etcd
   when: etcd_cluster_setup

kubespray/project/roles/etcd/tasks/join_etcd-events_member.yml

@@ -32,7 +32,7 @@
     executable: /bin/bash
   register: etcd_events_member_in_cluster
   changed_when: false
-  check_mode: no
+  check_mode: false
   tags:
     - facts
   environment:
@@ -46,4 +46,4 @@
   service:
     name: etcd-events
     state: started
-    enabled: yes
+    enabled: true

kubespray/project/roles/etcd/tasks/join_etcd_member.yml

@@ -33,7 +33,7 @@
     executable: /bin/bash
   register: etcd_member_in_cluster
   changed_when: false
-  check_mode: no
+  check_mode: false
   retries: "{{ etcd_retries }}"
   delay: "{{ retry_stagger | random + 3 }}"
   until: etcd_member_in_cluster.rc == 0
@@ -50,4 +50,4 @@
   service:
     name: etcd
     state: started
-    enabled: yes
+    enabled: true

kubespray/project/roles/etcd/tasks/main.yml

@@ -33,7 +33,7 @@
   command: "openssl x509 -in {{ etcd_cert_dir }}/node-{{ inventory_hostname }}.pem -noout -serial"
   register: "etcd_client_cert_serial_result"
   changed_when: false
-  check_mode: no
+  check_mode: false
   when:
     - kube_network_plugin in ["calico", "flannel", "cilium"] or cilium_deploy_additionally | default(false) | bool
     - kube_network_plugin != "calico" or calico_datastore == "etcd"

kubespray/project/roles/etcd/tasks/refresh_config.yml

@@ -3,7 +3,7 @@
   template:
     src: etcd.env.j2
     dest: /etc/etcd.env
-    mode: 0640
+    mode: "0640"
   notify: Restart etcd
   when: is_etcd_master and etcd_cluster_setup
 
@@ -11,6 +11,6 @@
   template:
     src: etcd-events.env.j2
     dest: /etc/etcd-events.env
-    mode: 0640
+    mode: "0640"
   notify: Restart etcd-events
   when: is_etcd_master and etcd_events_cluster_setup

kubespray/project/roles/etcd/tasks/upd_ca_trust.yml

@@ -21,7 +21,7 @@
     src: "{{ etcd_cert_dir }}/ca.pem"
     dest: "{{ ca_cert_path }}"
     remote_src: true
-    mode: 0640
+    mode: "0640"
   register: etcd_ca_cert
 
 - name: Gen_certs | update ca-certificates (Debian/Ubuntu/SUSE/Flatcar)  # noqa no-handler

kubespray/project/roles/etcd/templates/etcd.env.j2

@@ -71,8 +71,10 @@ ETCD_EXPERIMENTAL_INITIAL_CORRUPT_CHECK={{ etcd_experimental_initial_corrupt_che
 
 {% if etcd_experimental_enable_distributed_tracing %}
 ETCD_EXPERIMENTAL_ENABLE_DISTRIBUTED_TRACING=true
-ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_SAMPLE_RATE={{ etcd_experimental_distributed_tracing_sample_rate }}
+ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_SAMPLING_RATE={{ etcd_experimental_distributed_tracing_sample_rate }}
 ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_ADDRESS={{ etcd_experimental_distributed_tracing_address }}
 ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_SERVICE_NAME={{ etcd_experimental_distributed_tracing_service_name }}
 ETCD_EXPERIMENTAL_DISTRIBUTED_TRACING_INSTANCE_ID={{ etcd_member_name }}
-{% endif %}
+{% endif %}
+
+ETCD_EXPERIMENTAL_WATCH_PROGRESS_NOTIFY_INTERVAL={{ etcd_experimental_watch_progress_notify_interval }}

kubespray/project/roles/etcd/templates/openssl.conf.j2

@@ -25,6 +25,11 @@ authorityKeyIdentifier=keyid:always,issuer
 [alt_names]
 DNS.1 = localhost
 {% for host in groups['etcd'] %}
+{% if hostvars[host]['etcd_access_address'] is defined and not (hostvars[host]['etcd_access_address'] | ansible.utils.ipaddr) %}
+{# If defined, the address which etcd uses to access its members must be included in the SAN, otherwise etcd will fail with a TLS error upon startup. #}
+DNS.{{ counter["dns"] }} = {{ hostvars[host]['etcd_access_address'] }}{{ increment(counter, 'dns') }}
+{% endif %}
+{# This will always expand to inventory_hostname, which can be a completely arbitrary name, that etcd will not know or care about, hence this line is (probably) redundant. #}
 DNS.{{ counter["dns"] }} = {{ host }}{{ increment(counter, 'dns') }}
 {% endfor %}
 {% if apiserver_loadbalancer_domain_name is defined %}